Stored Cross-Site Scripting Vulnerability in Ultimate POS by UltimatePOS

CVE-2026-70560

What is CVE-2026-70560?

Ultimate POS (Stock Management & Point of Sale) is susceptible to a stored cross-site scripting vulnerability that permits low-privileged authenticated users, like Cashiers, to inject arbitrary HTML and script code into the system. By manipulating the user first-name field during account creation, these attackers can execute a malicious payload. When an admin-level user views notifications related to leave requests through the HRM/Leave module, the unsanitized content can be executed in their browser session. This vulnerability facilitates cross-user session compromise within the application, potentially leading to unauthorized access to sensitive information.

References